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ABSTRACT 


This report is a summary of the research conducted during the development of the Runway 
Incursion Advisory and Alerting System (RIAAS). RIAAS was developed under a cooperative 
agreement between Rannoch Corporation and NASA Langley Research Center. The research 
and development has been under the auspices of the NASA Aviation Safety Program. RIAAS is 
part of the overall NASA Runway Incursion Prevention System (RIPS). Rannoch’ s name for the 
commercial product version of RIAAS is PathProx . 

Rannoch has successfully developed an aircraft based runway incursion alerting system. 
Throughout the course of development RIAAS has undergone a series of tests. This includes 
flight tests conducted by NASA, flight simulator tests with airline subject pilots, and Rannoch 
tests with a computer simulation tool. The results of these tests have shown the following: 

• The basic RIAAS design concept for runway incursion alerting is valid. 

• Pilot feedback has been generally favorable. Several design changes recommended by 
the pilots have been incorporated into RIAAS. 

• RIAAS alerting performance is such that the alerts are generally provided with 
sufficient warning to enable safe evasive maneuvers. 

• All known incursion scenarios have been accounted for in the design. 

In addition, a series of analyses have been performed related to RIAAS implementation. These 
included analyses of Safety Benefits, and Key Technical Issues. Most of the key technical issues 
have been addressed either in terms of system design or technical standard specifications. Monte 
Carlo simulations found that the risk of collisions due to runway incursions could be nearly 
eliminated with universal RIAAS equipage. The simulations and analysis also found that 
RIAAS provides significant improvement in runway safety with equipage for only the ownship 
aircraft. 
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1.0 INTRODUCTION 

This report is a summary of the research conducted during the development of the 
Runway Incursion Advisory and Alerting System (RIAAS). RIAAS was developed 
under a cooperative agreement with NASA Langley Research Center. The research and 
development has been under the auspices of the NASA Aviation Safety Program. 

RIAAS is part of the overall NASA Runway Incursion Prevention System (RIPS). 

Airport surface incursions have been identified by the National Transportation Safety 
Board (NTSB) as one of the most significant safety hazards in civil aviation [Ref. 1], 
RIAAS is being developed by Rannoch Corporation to help address this problem. (Note- 
Rannoch’s name for the commercial product version of RIAAS is PathProx®) RIAAS is 
an aircraft-based runway incursion alerting system, and provides runway incursion alerts 
directly to the flight crews. 

Much of the material contained in this report was previously documented in prior reports 
published throughout the development of RIAAS. Those reports should be referred to for 
more details on the research summarized here. 

2.0 RIAAS FUNCTIONAL DESCRIPTION 

RIAAS is designed to monitor aircraft that are either on the airport surface, or are within 
the airport’s arrival and departure zones. The system initiates alert processing whenever 
an aircraft equipped with RIAAS (ownship) enters a runway zone, which includes the 
mnway, intersecting taxiways, arrival and departure zones associated with the runway. 
The system uses Automatic Dependent Surveillance - Broadcast (ADS-B) and Traffic 
Information Services - Broadcast (TIS-B) to track other aircraft/ground vehicles (traffic) 
operating in ownship’ s runway zone. RIAAS is configured to issue alerts based on the 
states and proximity of the aircraft. The alerting logic is the core of the RIAAS 
algorithms. Figure 1 shows a typical aircraft implementation. RIAAS requires a method 
for annunciating the alerts. Alerts may be annunciated visually and/or aurally. A typical 
implementation would be to provide alerts on a CDTI (Cockpit Display of Traffic 
Information) and an aural annunciation to draw the flight crew’s attention to the incursion 
situation (Figure 2). The implementation of RIAAS also requires an infrastructure 
outside of the aircraft (Figure 3). Optimum implementation would include a ground 
system that utilizes a combination of airport surface surveillance sensors. Aircraft and 
vehicle position information is then broadcast to the aircraft via TIS-B. However TIS-B 
is not required since RIAAS will operate using traffic information available from ADS-B 
equipped aircraft. 

RIAAS is designed to handle approximately forty different runway incursion scenarios. 
Parameters such as position, speed, acceleration, heading, distance to hold lines, distance 
to runway thresholds, distance to runway edge, closure rate and separation distance are 
measured for every vehicle operating in the vicinity of the runway being used. 
Calculations of each vehicle’s dynamic state are compared against the alerting criteria, 
and an alert is issued if the criteria are met for one or more incursion scenarios. If 
multiple scenarios occur simultaneously, the one with the highest level of alert is used in 
determining which alert will be issued. Once evasive action has been taken and there is 
no longer a state of alert, the alerts are cleared from the display. 
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Figure 1. Avionics Systems Architecture 



Figure 2. RIAAS Alert Display (NASA) 


RIAAS provides two types of alerts, analogous to TCAS. A Runway Traffic Alert (RTA) 
is generated when the ownship aircraft is involved in a runway incursion with other 
traffic that is not critical. The RTA acts to caution the pilot of a potential incursion or an 
incursion where the conflict does not yet require evasive action. A Runway Conflict Alert 
(RCA) is provided when an actual runway incursion has been detected, and there is 
potential for collision. An RCA indicates that the aircraft involved in the conflict needs 
to take evasive action to avoid the potential collision. Unlike TCAS, RIAAS does not 
provide guidance information to the pilot for taking evasive action. The reason for this is 
that the number and complexity of the scenarios make it difficult to correctly identify the 
proper evasive action to take in every situation. Information that is provided with each 
alert includes identification of the incurring aircraft (or vehicle), the runway associated 
with the aircraft, and separation distance. Alerts are displayed on a moving map display 
tailored to the airport surface. This display should provide enough information to the 
pilot to determine proper evasive action. 


2 



T raffic 




Figure 3. Systems Architecture 

3.0 RUNWAY INCURSIONS AND RIAAS ALERTING 

3. 1 Runway Incursions Description 

A runway incursion is defined by the FAA [Ref. 2] to be “any occurrence at an airport 
involving an aircraft, vehicle, person, or object on the ground, that creates a collision 
hazard or results in the loss of separation with an aircraft taking off, intending to take off, 
landing, or intending to land.” The causes of runway incursions are classified in four 
types: 

1 . Pilot Deviations (PD) - An action of a pilot that results in violation of a Federal 
Aviation Regulation. 

2. Operational Errors (OE) - An occurrence attributable to an element of the ATC 
system which results in: 

■ less than the applicable separation minima between two or more aircraft, 
or between an aircraft and terrain or obstacles, as required by FAA Order 
71 10.65, Air Traffic Control, and supplemental instructions. Obstacles 
include vehicles/equipment/personnel on runways; or 

■ an aircraft landing or departing on a runway closed to aircraft operations 
after receiving air traffic authorization. 

3. Operational Deviations (OD) - Controlled occurrences where applicable 
separation minima, as referenced in the definition of operational error (see above) 
are maintained, but 

■ less than the applicable separation minima existed between an aircraft and 
protected airspace without prior approval, or 
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■ an aircraft penetrated airspace that was delegated to another position of 
operation or another facility without prior coordination and approval. 

4. Vehicle/Pedestrian Deviations (VPD) - Incursions resulting from a vehicle 
operator, non-pilot operator of an aircraft, or a pedestrian who deviates onto the 
movement area (including the runway) without ATC authorization. 

The FAA also categorizes incursions by their severity [Ref. 3]. There are four categories 
of severity, with Category A being the most severe and Category D the least. Following 
are descriptions of the categories: 

Category A - Separation decreases and participants take extreme action to 
narrowly avoid a collision. 

Category B - Separation decreases and there is a significant potential for 
collision. 

Category C - Separation decreases but there is ample time and distance to avoid a 
potential collision. 

Category D - Little or no chance of collision but meets the definition of a runway 
incursion. 



Year 


Figure 4. Number of Runway Incursions in U.S. 
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Figure 5. Rate of Runway Incursions in U.S. (per million operations) 

The number and rate of runway incursions has remained relatively level over the last few 
years (Figures 4 and 5) [Ref. 3]. In addition to the increase in the total number, there 
have been a significant number of the most severe (Category A) incidents. For the years 
2000-2003, Category A incidents comprised 4% of all incursions, with a total number of 
59 such incidents (Figure 6). Category B incidents comprised 8.7% of all incursions, 
with a total of 129 incidents. 



Figure 6. Distribution of Incursions by Severity Category 

The severity of the incursion has been taken into account in determining the RIAAS 
alerting criteria. For incursion conflicts that fall into Categories C and D, RIAAS 
generally provides a Runway Traffic Alert. Since there is little chance of collision at the 
time of the conflict, there is no need to take immediate evasive action. It does however 
serve as a warning that there is potential for a more serious conflict. Category A and B 
conflicts meet the criteria for Runway Conflict Alerts because immediate evasive action 
is required. 
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3.2 Alerting in Specific Incursion Scenarios 

RIAAS is designed to detect all possible runway incursion scenarios. Appendix B lists 
all of the combinations of scenarios according to the vehicle state categories used in 
RIAAS. Alerts are generated for all of these scenarios when conditions indicate a 
conflict. 

4.2.1 Common Incursion Scenarios 

Figure 7 depicts four of the most common scenarios. These account for over 70% of 
runway incursion scenarios [Ref. 4]. The scenario in Figure 7A is when an aircraft taxis 
onto an active runway while an arrival aircraft is attempting to land. The scenario in 
Figure 7B is also when an aircraft taxis onto an active runway, this time when a departing 
aircraft is attempting to takeoff. The scenario in Figure 7C occurs when there is a loss of 
separation between a departing aircraft and an arrival. The scenario in Figure 7D occurs 
when there is a conflict on a converging runway operation. This scenario can involve the 
use of Land and Hold Short Operations (LAHSO) on the converging runways. In these 
operations aircraft are allowed to land and hold short of the intersection of the converging 
runway, while allowing traffic to operate independently on the other runway. 


A. Landing; Taxi Crossing 


B. Departing; Taxi Crossing 




Taxiway 


Taxi way 


C. Landing; Departing on Same Runway D. Landing; Departing on Crossing Runway 


- » ■ 


Figure 7. Common Runway Incursion Scenarios 

3.3 Accident and Incident Incursion Scenarios 

Following are descriptions of several accidents and incidents caused by runway 
incursions. Following each description is an indication of how RIAAS equipage (both 
aircraft) would have prevented the accident or incident from occurring. 

Los Angeles International, February 1, 1991: A Sky West commuter aircraft was 
cleared by air traffic control to position and hold for takeoff on runway 24L. 
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Subsequently the local controller forgot about the commuter aircraft’s position and 
cleared a US Air 737 for landing on 24L. The 737 crashed into the commuter aircraft, 
resulting in the loss of both aircraft and 34 fatalities [Ref. 5]. RIAAS would have alerted 
well in advance of the landing such that the 737 could have safely performed a go- 
around. 

Detroit Metropolitan, December 3, 1990: A Northwest 727 was on its takeoff roll on 
runway 9 when it was struck by a Northwest DC-9, which had just taxied onto the active 
runway. The accident occurred in low visibility conditions due to dense fog. The DC-9 
pilot was confused about his location and incorrectly taxied onto runway 9, causing a 
runway incursion and subsequently the accident. There were 8 fatalities and the DC-9 
was destroyed [Ref. 6]. The DC-9 would have received a RIAAS alert as soon as it 
crossed the hold line for the active runway, enabling it to stop prior to entering the 
runway. Similarly the 727 would have received a RIAAS alert shortly after starting its 
takeoff roll, enabling it to reject the takeoff 

St. Louis Lambert, November 22, 1994: A TWA MD-82 was on takeoff roll on 
runway 30R when it collided with a Cessna 441, in holding position for takeoff. The 
Cessna pilot had caused a runway incursion by incorrectly believing that he was assigned 
30R for takeoff, instead of runway 31, for which ATC had given clearance. The resulting 
accident resulted in 2 fatalities [Ref. 7]. The MD-82 would have received a RIAAS alert 
shortly after starting its takeoff roll, enabling it to reject the takeoff and prevent the 
collision. 

Chicago O’ Hare, April 1, 1999 : A China Airlines 747 freighter landed on Runway 
14R and was cleared to taxi to the cargo area. The crew apparently became confused and 
reentered the runway. A Korean Air 747-400, taking off on Runway 14R, flew over the 
China Airlines plane at less than 50 feet, as it was raising its landing gear. The China 
Airlines 747 would have received a RIAAS alert after it crossed the runway hold line, 
enabling it to stop prior to entering the runway. . 

Los Angeles International, November 22, 1999 : An Aeromexico MD-80 failed to 
hold short of an active runway and wandered into the path of a departing United Airlines 
757. The United pilot lifted the 757 off early and missed the MD-80 by approximately 
60 feet. The MD-80 would have received a RIAAS alert after it crossed the runway hold 
line, enabling it to stop prior to entering the runway. 


4.0 TEST RESULTS 

4 . 1 Flight Tests - Dallas Fort Worth Airport 

Flight testing of RIAAS was conducted during October 2000 as part of NASA’s Runway 
Incursion Prevention System (RIPS). During these tests several incursion scenarios were 
simulated. The aircraft equipped with RIAAS was the NASA B-757 Airborne Research 
Integrated Experiment System (ARIES). A test van was used to simulate the other 
aircraft in the runway incursion. References 8, 9, and 16 contain the detailed test results. 
The flight tests demonstrated that the basic design of RIAAS provided proper alerting for 
the three incursion scenarios tested. 
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4.2 NASA RIPS Research Flight Deck Simulator Tests 

4.2.1 RIPS Simulator Test Description 

NASA conducted piloted simulations of the Runway Incursion Prevention System (RIPS) 
in a full mission simulator (Research Flight Deck) at Langley Research Center in March 
2002 [Ref. 10]. The purpose of the study was to evaluate the RIPS airborne incursion 
detection algorithms (including RIAAS) and the associated alerting and airport surface 
display concepts. Eight commercial airline crews (16 pilots) participated as test subjects. 
The tests were conducted under various conditions, including VMC, low visibility (250 
ft), and with the various cockpit technologies (incursion alerting, moving map, HUD) 
enabled or disabled. RIAAS alerted as designed during all of the RIPS simulator tests. 
The RTA and RCA alerts were generated at the appropriate (as designed) locations 
during the incursion scenarios. There were no missed alerts or false alerts observed 
during the testing. 

4.2.2 RIPS Simulator Pilot Feedback 

NASA conducted a survey of the subject pilots to obtain their feedback on the RIPS 
implementation. The results and comments relevant to RIAAS are summarized here. The 
pilots were unanimous in feeling safer with the RIPS technologies in the cockpit. 

Seventy five percent of the pilots thought that the alerts were timely, by allowing 
sufficient time for the pilot to react to the conflict. There were some specific issues on 
timing that are discussed in more detail below. Seventy five percent of the pilots also 
thought that the two stage alerting was beneficial. This validates one of the basic design 
concepts in RIAAS - providing both a traffic alert and conflict alert. A minority of the 
pilots thought that providing escape maneuver guidance would be beneficial. 

Specifically the percentages of pilots favoring maneuver guidance for each operational 
phase were: final approach - 25%; takeoff - 31%; taxi - 44%. This finding validated 
another basic design concept in RIAAS - providing alerts only and not escape maneuver 
guidance. This is thought to be primarily a training issue. 

The pilots thought that the timeliness of the alerts was appropriate, with some exceptions. 
This feedback did result in several design changes as described in Section 6.7. 
Specifically, the feedback that identified the scenarios for some design changes was as 
follows: 

• During scenarios where ownship is on approach the pilots indicated that the alerts 
should be disabled following initiation of the go-around because they are a 
distraction at that point. Consequently a design change was implemented so that 
during go-arounds (both ownship and traffic) all alerts are cleared. 

• For scenarios where ownship is departing and there is an incursion by other 
traffic the time between the RTA and RCA was generally very short (2-3 
seconds). The subject pilots indicated that in this case the RTA did not serve 
much purpose because the time difference was so short, and because the pilot 
would reject the takeoff upon annunciation of the RTA, without waiting for the 
RCA. A design change was implemented to provide single stage alerting for 
these scenarios. 

• For scenarios where either ownship or traffic is stationary near the runway 
threshold, holding for takeoff, the subject pilots commented that the alerts should 
occur sooner than they did. The reason was that it is obvious very early in the 
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scenario that there is a conflict that can’t be resolved quickly. For example, when 
ownship is the aircraft in the holding position it is unable to vacate the runway in 
a timely manner. Therefore the alerts need to be provided sooner to allow for 
adequate evasive action. A design change was implemented to modify the alert 
thresholds to provide earlier alerting in these scenarios. 

4.3 GVSITE Flight Tests 

RIAAS tests were done as part of the NASA Gulfstream-V SVS Integrated Technology 
Evaluation (GVSITE). Included among the GVSITE technologies was the NASA 
Runway Incursion Prevention System (RIPS), with RIAAS being one of the two 
incursion alerting systems. The tests were initially conducted in the NASA Research 
Flight Deck (RFD) flight simulator, using Wallops Flight Center and Reno/Tahoe 
International as the test airports. Flight tests were conducted later at both airports. 

The primary focus for this set of tests for RIPS and RIAAS was evaluating the crossing 
runway alerting logic. Evaluation of RIAAS performance in all of the combinations of 
incursion scenarios indicates that the crossing runway alerting performed as designed. 

The testing validated the general design of the crossing runway alerting algorithms. The 
other new scenario tested was one intended to generate an alert based on a predicted 
violation of the taxiway hold line. This alerting was validated in the simulator tests. 
However the flight tests did not validate these alerts due to the way the scenario was 
conducted. 

There were a high percentage of missed alerts, mostly due to a traffic ADS-B data 
interface problem on the G-V aircraft. One missed alert was due to a minor problem with 
the RIAAS logic. The remainder of the missed alerts were due to the way the scenarios 
were conducted, specifically the hold line prediction scenario. There was one scenario 
with a late alert, which was due to an ownship data issue. RIAAS alerted as expected in 
all of the runs (with the exception of the one with the logic issue mentioned above) that 
were not affected by the ADS-B data problems. 

4.4 RIAAS Simulator Tests 

4.4.1 RIAAS Simulator Description 

The RIAAS simulator developed by Rannoch was used to generate the simulator results 
provided in this section. Reference 1 1 provides the detailed results for these tests. The 
simulations included the standard incursion scenarios, variable scenarios, and Monte 
Carlo scenarios. The RIAAS simulator generates tracks to be used for testing the RIAAS 
logic. The simulator provides a traffic display to show ownship and traffic position 
tracks. The display highlights the tracks involved in incursion alerts. The scenario 
database consists of the runway incursion scenarios that RIAAS is designed to process 
for alerting. In the simulation, Ownship performs evasive maneuvers in the event of a 
RCA (go-around, rejected takeoff, and emergency stop). 

4.4.2 Standard Incursion Scenario Results 

The fixed scenario is performed with a single run of ownship and traffic in real time. All 
of the incursion scenarios were run in the RIAAS simulator. Table 1 lists the results for 
six of these scenarios that are representative of nominal performance. The time-to- 
conflict is the time it would take for the two aircraft to collide, from the time of the alert. 
The separation distance is the distance between the two aircraft at the time of the alert. 
The RCAs nominally occur 25-35 seconds prior to a potential collision. This leaves 
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sufficient time to resolve the conflict. The RTAs nominally occur 10 seconds prior to the 
RCA. 

It should be noted that this does not account for the variability of the timing of the 
scenarios. The actual relative location of the two aircraft when the conflict occurs is 
mostly a random process. Therefore the time to conflict and separation distances can be 
smaller or larger than those shown in Table 1. However, these summary results do 
indicate that in nominal scenarios RIAAS alerts provide warnings that will enable safe 
evasive maneuvers. 


Table 1. Nominal Alerting Performance in Standard Scenarios 


SCENARIO 

RTA 

RCA 

Scenario 

Pair 

Ownship 

State 

Traffic 

State 

Conflict 

Time to 
Conflict 

(sec) 

Separation 

Distance 

(m) 

Time to 
Conflict 

(sec) 

Separation 

Distance 

(m) 

1 

Arrival 

Taxi 

Crossing 

33 

2300 

26 

1800 

4 

Taxi 

Arrival 

Crossing 

33 

2300 

26 

1800 

7 

Departure 

Taxi 

Crossing 

NA 

NA 

32 

1350 

10 

Taxi 

Departure 

Crossing 

42 

1500 

33 

1400 

34 

Arrival 

Stopped 

Head on 

47 

3300 

37 

2600 

35 

Departure 

Stopped 

Head on 

52 

1500 

29 

1250 


4.4.3 Monte Carlo Incursion Scenario Performance 

4.4.3. 1 Monte Carlo Method 

In a Monte Carlo scenario, multiple runs are performed, in fast time, whereby one or 
more parameters (i.e, relative aircraft timing or position) are varied randomly from one 
mn to the next. The RIAAS simulator provides the capability to configure simulation 
parameters, such as Ownship start time, Traffic start time, taxi crossing point, pilot 
response delay, and system alert delay. When a value is varied, the simulation 
automatically performs multiple runs with a variable being changed from one run to the 
next. The reason for conducting a Monte Carlo simulation is to obtain an estimate of the 
alerting algorithm performance under conditions that are randomly varied. The Monte 
Carlo simulations were evaluated primarily by determining the number of cases that 
result in collision, near collision, or safe separation. 

The simulator records closest separation and altitude between Ownship and Traffic. For 
this analysis, Ownship/Traffic encounters are categorized as follows, and as illustrated in 
Figure 8. 

• Collision - Lateral separation less than 200 feet with and altitude separation of 
less than 100 feet 

• Near Collision - Lateral separation between 200 and 300 feet with altitude 
separation less than 200 feet. 
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4.4.3. 2 Monte Carlo Simulator Scenarios 

Monte Carlo simulations were done with the two most critical incursion scenarios - 
arrival/taxi crossing and departure/taxi crossing (Figures 9 and 10). They were 
conducted with both combinations of ownship and traffic simulating the two aircraft 
involved. They were then run with the evasive maneuvers (meaning RIAAS equipage) 
operational with ownship only, with both ownship and traffic, or with no evasive 
maneuvers. The cases where there are no evasive maneuvers simulates operations where 
RIAAS alerting is not available on either aircraft, which provides a baseline of the 
likelihood of collision without any alerting. Each scenario was run with a total of 10,000 
samples. 



Arrival 


11 


Departure 



Figure 10. Departure/Taxi Crossing Incursion Scenario 


4.4.3. 3 Monte Carlo Scenario Results 

Arrival/T ax i Crossing Results 

The results of the Arrival/Taxi Crossing scenario simulations indicated that collisions 
were reduced from 12% to only 0.04% when the simulation was configured for both 
Ownship and Traffic to take evasive action on an RCA. There was also a significant 
overall increase in closest separation distances with evasive action on the RCAs. Results 
showed that the probability of collision is lower where ownship is the taxiing aircraft. 

The reason is that the pilot can stop the aircraft prior to entering the runway. When the 
ownship is the arrival aircraft, if the alert occurs during rollout, it still takes a significant 
period of time and distance to bring the aircraft to a stop. If the incurring aircraft creates 
an incursion while ownship is rolling out on the runway, there is likely to be a subsequent 
collision. This is the reason why RIAAS equipage on both aircraft is required to ensure a 
very low probability of collision in all cases. 

Departure/T axi Crossing Results 

The results of the Departure/Taxi Crossing scenario simulations indicated the percentage 
of collisions was reduced from 19.5% to zero when the simulation was configured for 
both Ownship and Traffic to take evasive action on an RCA. Again, there was an overall 
large increase in closest separation distances with evasive action on the RCAs. As 
explained with the Arrival/Taxi Crossing cases the probability of collision is lower if the 
ownship aircraft is the one taxiing rather than the departure aircraft. Again, this is 
because the taxi aircraft can stop quickly prior to entering the runway, whereas the 
departure aircraft takes significant time and distance to stop if the alert occurs during 
takeoff. 

5.0 SAFETY BENEFITS 

5. 1 Generic Safety Benefits 

RIAAS provides several generic safety benefits with regards to the risks associated with 
runway incursions. One is that RIAAS does not rely on air traffic controller input. 
Providing the alerts directly to the cockpit (as recommended by NTSB) has the advantage 
of minimizing the delays in reporting alerts to the pilot. ASDE-3/AMASS provides 
surface traffic and runway incursion alerts to the ATC tower controllers. When an alert 
occurs and is reported to the tower, the controller must notify the flight crews involved in 
the incursion, so that they may take action to avoid a collision. However, the controller 
reaction time and voice communications delays cost valuable seconds in alerting the 
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flight crew. RIAAS also does not rely on ground systems to generate incursion alert 
messages. This makes it possible for equipped aircraft to reap the benefit of increased 
safety even when flying into airports that are not equipped with ground-based incursion 
prevention and detection systems. 

Another generic benefit is improved pilot response to alerts. In addition to the reduced 
delays in alerting mentioned above, the pilot should also be able to take evasive action 
more quickly with RIAAS. This is partly due to the two stage alerting. Providing the 
Traffic Alert gives the pilot an indication of a potential conflict. By the time a Conflict 
Alert is generated the pilot should be aware of a pending conflict and the need for evasive 
action. Since it is assumed that the aircraft is also equipped with a moving map display 
with CDTI, the pilot should also have good situational awareness and be able to decide 
quickly on the optimum evasive maneuver. 

5.2 Quantification of Safety Improvement 

Following is a summary of the conclusions reached from the analysis of RIAAS safety 
benefits: 

1. Implementation of RIAAS has the potential to reduce the risk of the most 
severe runway incursions (those that can result in a catastrophic accident - 
Category A and B) from the present rate of 1.2x10 6 to less than 10 9 per 
operation. This was based on the results of the Monte Carlo simulations. 

2. The maximum safety benefit occurs at airports when there is no ground 
automated alerting and all traffic information is available to the aircraft 
equipped with RIAAS. In these situations RIAAS would provide the only 
incursion alerting function. 

3. With ground surveillance and AMASS alerting available there is still a 
significant RIAAS benefit. This is due to more timely alerting than provided 
by AMASS, by eliminating the delays associated with the controller and 
communications. In addition, RIAAS provides more timely alerting on 
ownship due to having more accurate position and state information (heading, 
speed, acceleration, etc.) than is available to ground surveillance. 

Any potential safety hazards associated with RIAAS would be related to the missed 
detection of runway incursion alerts and false alerts. Missed detections of incursions will 
be low enough that they will not impact the safety benefits. False alerts can result in 
unnecessary rejected takeoffs and go-arounds. The probability of RIAAS false alerts was 
found to be sufficiently low that it would not be an operational problem. References 12 
and 18 provide more details on the safety benefits analysis. 

6.0 KEY TECHNICAL ISSUES 

Reference 13 contains the details of the analysis of key technical issues. Issues related to 
the implementation of RIAAS have been reviewed throughout development. The areas 
where technical issues remain are the quality of ADS-B and TIS-B traffic data, and 
optimization of two stage alerting and the associated alert criteria. The quality of traffic 
data can affect the performance of incursion alerting algorithms, particularly the 
likelihood of missed and false alerts. 
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Items that were reviewed and found to have no significant issues remaining are ownship 
data quality, operational acceptability of alert criteria, incorporation of all incursion 
scenarios, safety, and compatibility with ATC ground alerting. Many of the technical 
issues that were identified in the DFW flight tests and RIPS simulator tests have already 
been addressed by incorporation of design changes in RIAAS, described in Section 6.7. 

6. 1 Traffic Data Quality 

Missing or erroneous ADS-B or TIS-B data is the most likely of the causes for a missed 
detection of an incursion. The NASA RIPS flight tests at DFW indicated several issues 
with the performance of ADS-B and TIS-B on the airport surface [Ref. 8, 9]. Erroneous 
data was manifested in several ways during the testing including incorrect position, 
speed, and heading data. Data link coverage was also an issue. One conclusion from the 
test evaluation was that incursion alerting logic performance is very dependent on the 
performance of the traffic position information. The information must be reliable, timely 
and accurate to ensure optimum runway incursion alerting performance. The ADS-B 
standards have addressed many of these issues in terms of the performance requirements 
[Ref. 14, 19]. 

Another issue is that TIS-B traffic data information has significantly longer latency than 
does ADS-B. Latencies of 2 to 6 seconds were observed in the TIS-B data recorded at 
DFW. This translates directly into delayed alerting on targets using position reports from 
TIS-B. It is assumed that the eventual implementation of TIS-B will have reduced 
latencies compared to those observed at DFW. However due to the inherent limitations 
in the processes involved it is doubtful the latency can be reduced below 2 seconds. 
Several features were added to RIAAS to address some of these issues, and are described 
in Section 6.7. 

6.2 Aircraft Position Reference Point and Size 

A key issue regarding traffic data concerns the ability to determine the location of the 
position information being broadcast via ADS-B, as well as the ability to determine the 
aircraft nose, tail, and wingtip. Since aircraft can have fuselage length and wingspans 
over 200 ft it is important for incursion alerting algorithms to be able to accurately 
determine the location of these points on the aircraft. A revision to the ADS-B Minimum 
Aviation System Performance Standard (MASPS) and Minimum Operational 
Performance Standards (MOPS) by RTCA includes changes to incorporate this 
information [Ref. 14, 19]. One change was to require that the position information 
broadcast be referenced to the “ADS-B Position Reference Point.” The second change 
was to define the aircraft dimensions according to size categories. These changes will 
enable incursion alerting algorithms to determine the location of the nose and tail of other 
aircraft with sufficient accuracy. 

6.3 Alert Criteria 

6.3.1 Two Stage Alerting 

As described in Section 3, RIAAS provides two stages of alerting. The issues involving 
two stage alerting that were addressed during the research are: a) Is two stage alerting 
necessary; b) Is two stage alerting appropriate for all scenarios; and, c) Is the time 
between the two alerts optimum operationally. 
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a) Is two stage alerting necessary 

The fundamental reason for two stage alerting is similar to that for other airborne alerting 
systems that have two levels of alerts such as TCAS and GPWS. The first alert (RTA) 
acts to caution the pilot of a potential incursion or an incursion where the conflict does 
not yet require evasive action. The second alert (RCA) is provided when there is potential 
for collision. An RCA indicates that the aircraft involved in the conflict needs to take 
evasive action to avoid the potential collision. Another reason for using two stage 
alerting relates to the severity of the incursion, which has been taken into account in 
determining the RIAAS alerting criteria. The FAA categorizes incursions by their 
severity as described in Section 3.1. For incursion conflicts that fall into Category D, 
RIAAS generally provides a RTA. Since there is little chance of collision at the time of 
the conflict, there is no need to take immediate evasive action. It does however serve as a 
warning that there is potential for a more serious conflict. The same logic applies to 
Category C. Category A and B conflicts meet the criteria for RCAs because immediate 
evasive action is required. Because of the large difference in severity depending upon the 
type of incursion, it is logical to provide two types of alerts with differing levels of 
criticality. As indicated in Section 4.2, the pilots generally support the concept of two 
stage alerting. 

b) Is two stage alerting appropriate for all scenarios 

The DFW flight tests and RIPS simulator tests have generally validated the concept that 
two stage alerting can be provided for the scenarios tested. One exception to this is the 
scenario where the conflict occurs while ownship is taking off. The time between the 
RTA and RCA is usually only a few seconds, and there are cases where the RCA 
occurred first. Generally the pilot is likely to initiate a rejected takeoff upon receiving 
either alert, so the two separate alerts are not necessary. As a consequence a design 
change was made to provide only an RCA for takeoff conflict scenarios. 

c) Is the time between the two alerts optimum operationally 

As shown in Table 1, the time between the RTA and RCA is generally on the order of 10 
seconds. This should provide sufficient warning to the pilot about a pending conflict, and 
allow him to decide the proper evasive action, should an RCA be received. This was 
validated during the flight and simulator testing. 

6.3.2 Operational Acceptability of Alert Criteria 

The simulator testing conducted at Langley Research Center using airline subject pilots 
indicated that the pilots generally believed that the RIAAS alerts were operationally 
acceptable in terms of the timing. One scenario that some pilots commented on was one 
where the ownship was on the runway holding for takeoff, when another aircraft is on 
final approach, causing a loss of separation. Some pilots recommended that the alerts be 
generated sooner in that situation. A design change was made resulting in earlier alerts 
for that scenario. 

6.3.3 Missed, Late, and False Alerts 

Potential safety hazards associated with RIAAS are related to the missed detection of 
runway incursion alerts and false alerts. Missed detections of incursions can be a safety 
hazard. False alerts can result in unnecessary rejected takeoffs and go-arounds. The 
RIAAS safety analysis concluded that the probability of RIAAS false alerts was found to 
be sufficiently low that it would not be an operational problem [Ref. 12]. This was based 
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on the assumption that the traffic data was compliant with the associated performance 
standards. 

The other aspect of late and false alerts concerns the incursion criteria used. The design 
must be optimized to balance the likelihood of both. If the criteria are relaxed such that 
zero false alerts occur, it is more likely that this will result in late alerts. Conversely, if 
the criteria were such that alerts occur as soon as possible, the number of false alerts 
would increase. One of the biggest factors is the accuracy of the surveillance data. The 
alert thresholds have to take into account position errors (as well as speed and heading) in 
ADS-B and TIS-B traffic reports. The alert criteria currently used in RIAAS take this 
into account and attempt to minimize the likelihood of false alerts. From a pilot and 
controller acceptance viewpoint the number of false alerts should be as small as possible, 
otherwise it could jeopardize the acceptability of RIAAS. Optimization of the alert 
criteria includes accounting for the difference in quality of traffic information. 

6.5 Compatibility with ATC Ground Alerting 

This issue concerns the compatibility of airborne incursion alerting with ground 
surveillance alerting systems, such as the FAA’s AMASS (Airport Movement Area 
Safety System). It is likely that RIAAS and a ground system such as AMASS will not 
generate incursion alerts at the same time. The NASA DFW testing indicated that this is 
the case [Ref. 8]. The resulting question is whether this can cause any operational 
problems. RIAAS generally will alert sooner, primarily due to having more accurate 
position information. This means that pilots could take evasive action prior to the 
controller being aware of the conflict. The controller will then have to react to the 
evasive maneuver being taken and generate any other necessary instructions to the 
aircraft involved. This could cause some issues in the willingness of controllers to accept 
the system, who had to deal with a similar situation with the implementation of TCAS. 
However, the pilot always has the option of taking action to avoid conflicts with other 
aircraft, usually by visual means. The only difference with RIAAS will be that the pilot 
has an additional aid (including the moving map and CDTI) to inform him of conflicts. 

So in that sense this is not a change in operational procedures. Furthermore, the overall 
rate of incursions is low enough that the frequency of evasive actions will be extremely 
low. Another possible mitigation for this if it does become an operational issue would be 
for the aircraft to transmit runway conflict alert notification to Air Traffic Control. This 
could be done via the TIS-B or ADS-B data links. This would allow the controller to be 
aware of a conflict and enable him to provide instructions to the aircraft for evasive 
maneuvers. This capability was demonstrated by NASA as part of the DFW RIPS flight 
tests. 

6.6 Airport Database 

RIAAS requires an airport database to define the locations of runways and taxiways. The 
key elements necessary are the runway thresholds, runway edges, airport elevation, 
taxiway hold lines, and land and hold short locations. The key technical issues relative to 
the database are availability, accuracy, and integrity. The primary issue is simply having 
the information available. Currently aircraft do not have airport surface information 
available in an electronic database. An initial set of standards for the data have been 
completed by RTCA and are contained in DO-272 “User Requirements for Aerodrome 
Mapping Information” [Ref. 15]. The accuracy required for the various data elements 
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have been specified in DO-272. The requirements most applicable to RIAAS specify the 
95% accuracy to be 1 meter for most data elements. This level of accuracy is good 
enough to eliminate database errors from contributing to late or false alerts generated by 
RIAAS. That is because the other errors in the system (ownship position, traffic position, 
etc.) are much greater than 1 meter. DO-272 categorizes the accuracy requirements as 
“fine,” “medium,” and “coarse.” The 1 m accuracy is associated with “fine.” Medium 
data elements specify the largest 95% accuracy to be 5 m. The minimum requirement for 
RIAAS should be “medium” data. However, there may be an issue regarding 5 m 
accuracy for the key data points. The alert thresholds may have to be relaxed in order to 
prevent a higher number of false alerts. This will reduce the effectiveness of RIAAS 
somewhat by resulting in later alerts. 

Database integrity relates to the probability of either erroneous or missing data. DO-272 
specifies a maximum error allowed. For the airport surface data points of interest in the 
“fine” category the maximum error is defined as either 2 or 3 meters. That will be 
sufficient to minimize any impact on RIAAS performance. DO-272 also recommends 
the integrity levels for some, but not all, data elements. For applications using “fine” data 
some are classified as critical, which has an associated probability of erroneous data of 

o 

10' . Applications using “medium” data do not have any integrity levels recommended. 
An issue here is ensuring that the data used by RIAAS has the appropriate level of 
integrity. The impact on RIAAS performance with erroneous data points is similar to 
that with reduced accuracy, namely late or false alerts. The RIAAS safety benefits 
analysis [Ref. 12] indicated that for integrity failures in aircraft position information the 
probability should be on the order of 10 5 to 10 6 . The airport surface data points should 
be similarly classified. That would be consistent with the definition of the “essential” 
integrity level in DO-272, which has a probability of erroneous data of 10 5 . 

6.7 Design Changes 

Following are some of the significant design changes made during the development of 
RIAAS that were determined to be necessary based on the findings from the research: 

• During go-arounds (ownship and traffic) alerts are cleared 

• Added alerts based on a prediction of hold line violation by taxiing aircraft 
(ownship and traffic) 

• Added criteria for removing outliers and filtering traffic data (ADS-B and TIS-B) 

• Changed to single stage only alerting (runway conflict) for scenarios where 
ownship is departing 

• For scenarios where either ownship or traffic is stationary near the runway 
threshold, holding for takeoff, the alert thresholds were changed to occur earlier 
with the other aircraft (ownship or traffic) on approach. 
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SUMMARY 

Under a cooperative agreement with NASA, Rannoch Corporation has successfully 
developed an aircraft based runway incursion alerting system called RIAAS. Throughout 
the course of development RIAAS has undergone a series of tests. This includes flight 
tests conducted by NASA, flight simulator tests with airline subject pilots, and Rannoch 
tests with a computer simulation tool. The results of these tests have shown the 
following: 

• The basic RIAAS design concept for runway incursion alerting is valid. 

• Pilot feedback has been generally favorable. Several design changes 
recommended by the pilots have been incorporated into RIAAS. 

• RIAAS alerting performance is such that the alerts are generally provided with 
sufficient warning to enable safe evasive maneuvers. 

• All known incursion scenarios have been accounted for in the design. 

In addition, a series of analyses have been performed related to RIAAS implementation. 
These included analyses of Safety Benefits, and Key Technical Issues. Most of the key 
technical issues have been addressed either in terms of system design or technical 
standard specifications. Monte Carlo simulations found that the risk of collisions due to 
runway incursions could be nearly eliminated with universal RIAAS equipage. The 
simulations and analysis also found that RIAAS provides significant improvement in 
runway safety with equipage on only the ownship aircraft. 
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ADS-B Automatic Dependent Surveillance - Broadcast 

AMASS Airport Movement Area Safety System 

ARIES Airborne Research Integrated Experiment System 

ASDE Airport Surface Detection Equipment 

ATC Air Traffic Control 

CDTI Cockpit Display of Traffic Information 

DFW Dallas-Fort Worth International Airport 

FAA Federal Aviation Administration 

GPS Global Positioning System 

GPWS Ground Proximity Warning System 

HUD Head-Up Display 

LAHSO Landing and Hold Short Operations 

NASA National Aeronautics and Space Administration 

NM Nautical Mile 

NTSB National Transportation Safety Board 

OD Operational Deviations 

OE Operational Errors 

PD Pilot Deviations 

RCA Runway Conflict Alert 

RFD Research Flight Deck 

RIAAS Runway Incursion Advisory and Alerting System 
RIPS Runway Incursion Prevention System 

RTA Runway Traffic Alert 

TCAS Traffic Alerting and Collision Avoidance System 

TIS-B Traffic Information Services - Broadcast 

VMC Visual Meteorological Conditions 

VPD Vehicle / Pedestrian Deviations 
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